Privacy Policy | ProCon Medical

1. Who is responsible for your data?

The data controller is ProCon Medical OÜ, a company registered in Estonia.

Company: ProCon Medical OÜ
Registry code: 11071397
Email: info@proconmedical.eu
Phone: +372 585 4288

You can contact us using the details above if you have questions about this policy or the processing of your personal data.

2. What personal data do we collect?

The information we collect depends on how you interact with our website and services. It may include:

Contact information: your name, email address, telephone number and the information you include in a message.
Appointment information: requested services, preferred appointment times, booking details and communications relating to your appointment.
Health information: information about your health or medical history that you choose to provide or that is necessary for the provision and documentation of healthcare.
Technical information: information such as your IP address, browser type, device information and website activity, where collected by the website or its services.
Cookie and analytics information: information collected through cookies or similar technologies, subject to your cookie preferences and applicable law.

Please do not include unnecessary sensitive medical information in a general website contact form. We will explain how to provide any additional information required for your care.

3. Why do we process personal data?

Appointments and healthcare services

To receive and manage appointment requests, communicate with patients, coordinate appointments and provide healthcare services.

Enquiries and communication

To respond to questions, provide requested information and follow up on communications.

Website operation and security

To operate and maintain the website, prevent misuse, protect our systems and troubleshoot technical issues.

Analytics and advertising

Where applicable, and subject to your choices and applicable consent requirements, to understand website usage and measure the effectiveness of our marketing.

Legal and administrative obligations

To meet applicable legal, accounting, healthcare documentation and other regulatory requirements, and to establish or defend legal claims where necessary.

4. Legal bases for processing

Under the General Data Protection Regulation (GDPR), we process personal data only where an applicable legal basis exists. Depending on the circumstances, this may include:

Steps before a contract or performance of a contract: for handling relevant appointment requests and providing agreed services.
Legal obligations: for processing required by applicable law.
Legitimate interests: for appropriate website security, service administration and protecting legal rights, where these interests are not overridden by your rights.
Consent: for processing activities that require consent, including applicable non-essential cookies and analytics or advertising technologies.

Health data is subject to additional protection. Where we process health data, we must also satisfy an applicable condition under Article 9 of the GDPR and any relevant Estonian healthcare and data protection legislation. The appropriate legal basis depends on the specific processing activity.

5. Cookies and website analytics

Our website may use necessary cookies and, where enabled, analytics or marketing technologies.

Necessary cookies

These support essential website functions, security and the operation of your selected preferences.

Analytics cookies

Where enabled and permitted, analytics tools such as Google Analytics may help us understand how visitors use the website.

Marketing cookies

Where enabled and permitted, marketing technologies may be used to measure advertising performance or support advertising campaigns.

Non-essential cookies and similar technologies should only be activated where the required consent has been obtained. You can review or change your cookie preferences using the cookie settings control on our website.

6. Who may receive your data?

We only disclose personal data where necessary for the purposes described in this policy, where an appropriate legal basis exists, or where disclosure is required by law.

Depending on the services in use, recipients may include:

Authorised clinic personnel and healthcare professionals.
Website hosting, maintenance and IT service providers.
Email and appointment-management service providers.
Analytics or advertising providers, where enabled.
Payment service providers, where applicable.
Public authorities and regulators where legally required.

Service providers may process data on our behalf under applicable contractual and legal safeguards. We do not sell personal data.

7. International data transfers

Some service providers may process personal data outside the European Economic Area (EEA). Where personal data is transferred internationally, we will apply the safeguards required by applicable data protection law, where relevant. These may include an adequacy decision or appropriate contractual safeguards.

8. How long do we retain personal data?

We retain personal data only for as long as necessary for the purpose for which it was collected, subject to applicable legal retention requirements.

Enquiries are retained for the time needed to respond and manage any resulting follow-up.
Appointment and healthcare records are retained in accordance with applicable healthcare, documentation and legal requirements.
Accounting records are retained for the period required by applicable law.
Cookie preferences and analytics data are retained according to the relevant settings, consent choices and service retention configuration.

Exact retention periods depend on the type of data and the applicable legal requirements. Data is deleted or anonymised when it is no longer needed and no legal obligation requires it to be retained.

9. How do we protect your data?

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration and disclosure. Measures are selected according to the nature of the data, the risks involved and applicable legal requirements.

10. Your data protection rights

Subject to the conditions and exceptions set out in applicable law, you may have the right to:

Request access to your personal data.
Request correction of inaccurate or incomplete data.
Request erasure of your data where the legal conditions are met.
Request restriction of processing in certain circumstances.
Object to processing where the law provides this right.
Receive certain data in a portable format.
Withdraw consent at any time where processing is based on consent.
Lodge a complaint with a data protection supervisory authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Some data may need to be retained where required by law.

To exercise your rights, contact us at info@proconmedical.eu . We may need to verify your identity before responding.

11. Complaints

If you believe that your personal data has been processed unlawfully, you can contact us first so that we can review your concern.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Visit the Estonian Data Protection Inspectorate

12. Changes to this Privacy Policy

We may update this policy to reflect changes in our services, website technologies or applicable law. The latest version will be published on this page with its updated revision date.